Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV)

[giv]

lol
Many of us don't have knowledge to reverse a simple crackme.

[Deathway]

[v1.7]
- FISH machine avaible (WHITE and RED variants)
- Added Vm signatures

Hi all, the new version of this plug-in supports the FISH virtual machine, WHITE and RED variants.

Some words about this machine...

It mixes both CISC and RISC architecture, but the code isn't like template anymore, every virtual machine has a new different number of handlers, and every handler contains a different execution path, a little tricky, but nothing that can't be 'devirtualized' , maybe i'll write a paper about FISH and TIGER machines later.

Some specs that aren't coded yet:
- Support for Check macro;
- Sort algo is very unstable
- This plugin may crash when deofuscating very rare sequences, (most of them are 'expected' specially when crash was due to an ud2 instruction).
- Suppor for BLACK variants

... About TIGER, I have no plans for the moment, but it isn't very different from FISH analog.
Plug-in was tested with 2.2.6.0 version, other versions may have variants that this plug-in couldn't handle.


Deathway.

[Conquest]

Originally Posted by Deathway

[v1.7]
- FISH machine avaible (WHITE and RED variants)
- Added Vm signatures

Hi all, the new version of this plug-in supports the FISH virtual machine, WHITE and RED variants.

Some words about this machine...

It mixes both CISC and RISC architecture, but the code isn't like template anymore, every virtual machine has a new different number of handlers, and every handler contains a different execution path, a little tricky, but nothing that can't be 'devirtualized' , maybe i'll write a paper about FISH and TIGER machines later.

Some specs that aren't coded yet:
- Support for Check macro;
- Sort algo is very unstable
- This plugin may crash when deofuscating very rare sequences, (most of them are 'expected' specially when crash was due to an ud2 instruction).
- Suppor for BLACK variants

... About TIGER, I have no plans for the moment, but it isn't very different from FISH analog.
Plug-in was tested with 2.2.6.0 version, other versions may have variants that this plug-in couldn't handle.


Deathway.

LF> the paper . thanks for the great update